|
634
|
1 ===================================================================================================
|
|
|
2
|
|
|
3 OSTC hwos3 COMM Mode Documentation
|
|
|
4
|
|
|
5 16.03.2020
|
|
|
6
|
|
|
7 ===================================================================================================
|
|
|
8
|
|
|
9 Remarks: - send and receive as given here are from OSTC point of view,
|
|
|
10
|
|
|
11 - timeouts restart on each next byte received,
|
|
|
12
|
|
|
13 - when designing the peer side, account for additional delays caused
|
|
|
14 by USB/BT low level drivers,
|
|
|
15
|
|
|
16 - initiate a buffer flush after each command or parameter/data block
|
|
|
17 and wait on the OSTC response before sending the next command/data,
|
|
|
18
|
|
|
19 - the 3 byte start address and the 3 byte length are expected in network
|
|
|
20 byte format (big endian).
|
|
|
21
|
|
|
22
|
|
|
23 comm_mode_selection_loop: ## entry point when COMM Mode is started ##
|
|
|
24
|
|
|
25 try to receive 1 byte, timeout after 4 minutes
|
|
|
26 received 0xBB -> goto comm_download_mode
|
|
|
27 received 0xAA -> goto comm_service_mode_check
|
|
|
28 timeout -> send 0xFF
|
|
|
29 quit comm mode
|
|
|
30
|
|
|
31
|
|
|
32 comm_service_mode_check: ## received start byte for service mode, await service key ##
|
|
|
33
|
|
|
34 send 0x4B
|
|
|
35 |
|
|
|
36 | Attention: do not send the next 3 bytes in one batch, wait for
|
|
|
37 | the echo of each byte before sending the next one
|
|
|
38 |
|
|
|
39 try to receive 1 byte (upper byte of comm service key), timeout after 400 ms
|
|
|
40 echo received byte
|
|
|
41 try to receive 1 byte (high byte of comm service key), timeout after 400 ms
|
|
|
42 echo received byte
|
|
|
43 try to receive 1 byte (low byte of comm service key), timeout after 400 ms
|
|
|
44 echo received byte
|
|
|
45
|
|
|
46 service key correct -> enable comm_service_mode, goto comm_command_loop
|
|
|
47 service key not correct -> goto comm_mode_selection_loop
|
|
|
48 timeout -> goto comm_mode_selection_loop
|
|
|
49
|
|
|
50
|
|
|
51 comm_download_mode: ## received start byte for download mode ##
|
|
|
52
|
|
|
53 send 0xBB
|
|
|
54 goto comm_command_loop
|
|
|
55
|
|
|
56
|
|
|
57 comm_command_loop: ## wait for a command ##
|
|
|
58
|
|
|
59 if comm_service_mode is enabled -> send 0x4C
|
|
|
60 else -> send 0x4D
|
|
|
61
|
|
|
62 try to receive 1 byte, timeout after 2 minutes
|
|
|
63
|
|
|
64 timeout -> send 0xFF and quit comm mode
|
|
|
65 received 0x6E -> goto comm_show_text n show a text on the screen
|
|
|
66 received 0x69 -> goto comm_identify i send ID: serial, firmware, and custom text
|
|
|
67 received 0x6A -> goto comm_hardware_descriptor j send ID: hardware descriptor byte
|
|
|
68 received 0x60 -> goto comm_feature_and_hardware ' send ID: more detailed information
|
|
|
69 received 0x6D -> goto comm_send_headers_short m send all headers in compact format
|
|
|
70 received 0x61 -> goto comm_send_headers_full a send all headers is full format
|
|
|
71 received 0x66 -> goto comm_send_dive f send header and profile for one dive
|
|
|
72 received 0x62 -> goto comm_set_time b set the real time clock
|
|
|
73 received 0x63 -> goto comm_set_custom_text c write a new custom text
|
|
|
74 received 0x72 -> goto comm_read_option r read an option value
|
|
|
75 received 0x77 -> goto comm_write_option w write an option value (into RAM)
|
|
|
76 received 0x78 -> goto comm_option_reset_all x reset all option values to their factory default
|
|
|
77 received 0xFF -> send 0xFF and quit comm mode
|
|
|
78
|
|
|
79 the following commands are only evaluated if comm_service_mode is enabled:
|
|
|
80
|
|
|
81 received 0x23 -> goto comm_reset_battery_gauge # reset the battery gauge registers
|
|
|
82 received 0x22 -> goto comm_erase_complete_logbook " reset all logbook pointers and the logbook
|
|
|
83 received 0x20 -> goto comm_read_range ' ' read a memory range from the external FLASH
|
|
|
84 received 0x40 -> goto comm_erase_4kb @ erase one 4 kB block - Warning: no confirmation or built-in safety here...
|
|
|
85 received 0x42 -> goto comm_erase_range4kb B erase a range of 4 kB blocks - Warning: no confirmation or built-in safety here...
|
|
|
86 received 0x30 -> goto comm_write_range_stream 0 write a stream of bytes starting at ext_flash_address:3 until timeout
|
|
|
87 received 0x31 -> goto comm_write_range_block 1 write a block of 256 bytes starting at ext_flash_address:3 (only available with FW >= 3.08)
|
|
|
88 received 0x50 -> goto comm_firmware_update P initiate firmware update
|
|
|
89 received 0xC1 -> goto comm_cold_start start low-level bootloader
|
|
|
90
|
|
|
91
|
|
|
92
|
|
|
93 comm_set_time: ## set the real time clock ##
|
|
|
94
|
|
|
95 send 0x62
|
|
|
96 try to receive 6 bytes in sequence: hour, minute, second, month, day, year, timeout 400 ms
|
|
|
97 timeout -> goto comm_command_loop
|
|
|
98 else -> set RTC, goto comm_command_loop
|
|
|
99
|
|
|
100
|
|
|
101 comm_show_text: ## write a 15 char text to the OSTC display ##
|
|
|
102
|
|
|
103 send 0x6E
|
|
|
104 try to receive 16 characters, timeout 400 ms
|
|
|
105 print whatever has been received to the display
|
|
|
106 goto comm_command_loop
|
|
|
107
|
|
|
108
|
|
|
109 comm_identify: ## reply serial, firmware and custom text ##
|
|
|
110
|
|
|
111 send 0x69
|
|
|
112 send 1 byte serial number, low byte
|
|
|
113 send 1 byte serial number, high byte
|
|
|
114 send 1 byte firmware version, major
|
|
|
115 send 1 byte firmware version, minor
|
|
|
116 send 60 byte custom text
|
|
|
117 goto comm_command_loop
|
|
|
118
|
|
|
119
|
|
|
120 comm_hardware_descriptor: ## reply short hardware descriptor ##
|
|
|
121
|
|
|
122 send 0x6A
|
|
|
123 send 1 byte hardware descriptor
|
|
|
124 goto comm_command_loop
|
|
|
125
|
|
|
126
|
|
|
127 comm_feature_and_hardware: ## reply detailed hardware descriptor ##
|
|
|
128
|
|
|
129 send 0x60
|
|
|
130 send 0x00 (hardware high byte)
|
|
|
131 send 1 byte hardware descriptor (hardware low byte)
|
|
|
132 send 0x00 (feature high byte)
|
|
|
133 send 0x00 (feature low byte)
|
|
|
134 send 0x00 (model)
|
|
|
135 goto comm_command_loop
|
|
|
136
|
|
|
137
|
|
|
138 comm_send_headers_short: ## send short version of dive headers ##
|
|
|
139
|
|
|
140 send 0x6D
|
|
|
141 send 256 x 16 bytes (extract from the headers)
|
|
|
142 goto comm_command_loop
|
|
|
143
|
|
|
144
|
|
|
145 comm_send_headers_full: ## send complete dive headers ##
|
|
|
146
|
|
|
147 send 0x61
|
|
|
148 send 256 x 256 bytes
|
|
|
149 goto comm_command_loop
|
|
|
150
|
|
|
151
|
|
|
152 comm_send_dive: ## send one full dive ##
|
|
|
153
|
|
|
154 send 0x66
|
|
|
155 try to receive 1 byte (dive index), timeout 400 ms
|
|
|
156 timeout -> goto comm_command_loop
|
|
|
157 header contains no dive -> goto comm_command_loop
|
|
|
158 no profile data available -> send 256 byte dive header (begins with 0xFAFA),
|
|
|
159 send empty profile: <length = 0x000008> <end = 0xFDFD>,
|
|
|
160 goto comm_command_loop
|
|
|
161 else -> send 256 byte dive header (begins with 0xFAFA),
|
|
|
162 send xxx byte dive profile (ends with 0xFDFD),
|
|
|
163 goto comm_command_loop
|
|
|
164
|
|
|
165
|
|
|
166 comm_option_reset_all: ## reset all options to factory default ##
|
|
|
167
|
|
|
168 send 0x78
|
|
|
169 reset all option values to default
|
|
|
170 goto comm_command_loop
|
|
|
171
|
|
|
172
|
|
|
173 comm_set_custom_text: ## set custom text ##
|
|
|
174
|
|
|
175 send 0x63
|
|
|
176 try to receive 60 byte, timeout 400 ms
|
|
|
177 clear complete old custom text
|
|
|
178 store the 0...60 bytes that have been received as new custom text
|
|
|
179 goto comm_command_loop
|
|
|
180
|
|
|
181
|
|
|
182 comm_reset_battery_gauge: ## reset battery gauge ##
|
|
|
183
|
|
|
184 (no acknowledge send)
|
|
|
185 reset battery registers and battery gauge chip
|
|
|
186 goto comm_command_loop
|
|
|
187
|
|
|
188
|
|
|
189
|
|
|
190 comm_erase_complete_logbook: ## erase complete Logbook ##
|
|
|
191
|
|
|
192 (no acknowledge send)
|
|
|
193 erase complete logbook
|
|
|
194 goto comm_command_loop
|
|
|
195
|
|
|
196
|
|
|
197 comm_cold_start: ## start bootloader (cold start) ##
|
|
|
198
|
|
|
199 (no acknowledge send)
|
|
|
200 backup crucial data from RAM to EEPROM
|
|
|
201 jump into the bootloader/cold start
|
|
|
202
|
|
|
203
|
|
|
204 comm_firmware_update: ## initiate firmware update ##
|
|
|
205
|
|
|
206 send 0x50
|
|
|
207 try to receive 5 byte checksum, timeout 400 ms
|
|
|
208 timeout -> send 0xFF, goto comm_command_loop
|
|
|
209 checksum faulty -> send 0xFF, goto comm_command_loop
|
|
|
210 else -> send 0x4C
|
|
|
211 backup crucial data from RAM to EEPROM
|
|
|
212 jump into bootloader/FW update
|
|
|
213
|
|
|
214
|
|
|
215 comm_erase_range4kb: ## erase a memory range ##
|
|
|
216
|
|
|
217 send 0x42
|
|
|
218 try to receive 3 byte start address, timeout 400 ms
|
|
|
219 try to receive 1 byte block count, timeout 400 ms
|
|
|
220 any timeout -> goto comm_command_loop
|
|
|
221 else -> erase FLASH from start address, range block_count x 4 kByte,
|
|
|
222 takes up to block_count * 25 ms, i.e. for 120 kB (30 blocks) up to 750 ms
|
|
|
223 goto comm_command_loop
|
|
|
224
|
|
|
225
|
|
|
226 comm_erase_4kb: ## erase one 4 kB block ##
|
|
|
227
|
|
|
228 (no acknowledge send)
|
|
|
229 try to receive 3 byte start address, timeout 400 ms
|
|
|
230 timeout -> goto comm_command_loop
|
|
|
231 else -> erase FLASH from start address, range 4 kByte, takes up to 25 ms
|
|
|
232 goto comm_command_loop
|
|
|
233
|
|
|
234
|
|
|
235 comm_write_range_stream: ## write a stream of bytes to the FLASH ##
|
|
|
236
|
|
|
237 send 0x30
|
|
|
238 try to receive 3 byte start address, timeout 400 ms
|
|
|
239 timeout -> goto comm_command_loop
|
|
|
240 else -> loop {try to receive 1 byte, write byte to FLASH } until timeout
|
|
|
241 |
|
|
|
242 | Attention: Do not send the bytes too fast as the OSTC needs
|
|
|
243 | some time for each byte to write it to the FLASH.
|
|
|
244 |
|
|
|
245 | Bytes will be received and written to FLASH until a timeout occurs,
|
|
|
246 | i.e. to end the writing stop sending and await the timeout to trigger.
|
|
|
247 |
|
|
|
248 timeout -> goto comm_command_loop
|
|
|
249
|
|
|
250
|
|
|
251 comm_write_range_block: ## write a block of 256 bytes to the FLASH ##
|
|
|
252 (only available with FW >= 3.09)
|
|
|
253 send 0x31
|
|
|
254 try to receive 3 byte start address, timeout 400 ms
|
|
|
255 timeout -> goto comm_command_loop
|
|
|
256 low byte of start address <> 0 -> goto comm_command_loop
|
|
|
257 else -> try to receive 256 byte, timeout 400 ms
|
|
|
258 timeout -> goto comm_command_loop
|
|
|
259 else -> write the 256 byte to FLASH,
|
|
|
260 takes up to 2 or 5 ms dependent on FLASH chip
|
|
|
261 goto comm_command_loop
|
|
|
262
|
|
|
263
|
|
|
264 comm_read_range: ## read a range from FLASH ##
|
|
|
265
|
|
|
266 send 0x20
|
|
|
267 try to receive 3 byte start address, timeout 400 ms
|
|
|
268 try to receive 3 byte length, timeout 400 ms
|
|
|
269 any timeout -> goto comm_command_loop
|
|
|
270 else -> loop {read 1 byte from FLASH, send 1 byte } until #length bytes done
|
|
|
271 goto comm_command_loop
|
|
|
272
|
|
|
273
|
|
|
274 comm_read_option: ## read an option value ##
|
|
|
275
|
|
|
276 send 0x72
|
|
|
277 try to receive 1 byte option index, timeout 400 ms
|
|
|
278 timeout -> goto comm_command_loop
|
|
|
279 index = 0x10 - 0x19 -> send 4 bytes in sequence O2%, He%, type, change depth
|
|
|
280 goto comm_command_loop
|
|
|
281 index = 0x1A - 0x1E -> send 2 bytes in sequence setpoint cbar, change depth
|
|
|
282 goto comm_command_loop
|
|
|
283 index = 0x1F - 0xXX -> send 1 byte option value (0xXX last index in use, depends on FW version)
|
|
|
284 goto comm_command_loop
|
|
|
285 else -> goto comm_command_loop
|
|
|
286
|
|
|
287
|
|
|
288 comm_write_option: ## write an option value ##
|
|
|
289
|
|
|
290 send 0x77
|
|
|
291 try to receive 1 byte option value, timeout 400 ms
|
|
|
292 timeout -> goto comm_command_loop
|
|
|
293 |
|
|
|
294 | Attention: do not send the option values too fast after the option index,
|
|
|
295 | as the OSTC does not know how many bytes will follow after the
|
|
|
296 | index before it has actually evaluated the index!
|
|
|
297 | This is a flaw in the protocol design...
|
|
|
298 |
|
|
|
299 index = 0x10 - 0x19 -> try to receive 4 byte in sequence O2%, He%, type, change depth
|
|
|
300 timeout -> goto comm_command_loop
|
|
|
301 else -> update option
|
|
|
302 goto comm_command_loop
|
|
|
303 index = 0x1A - 0x1E -> try to receive 2 bytes in sequence setpoint cbar, change depth
|
|
|
304 timeout -> goto comm_command_loop
|
|
|
305 else -> update option
|
|
|
306 goto comm_command_loop
|
|
|
307 index = 0x1F - 0xXX -> try to receive 1 byte option value (0xXX last index in use, depends on FW version)
|
|
|
308 timeout -> goto comm_command_loop
|
|
|
309 else -> update option
|
|
|
310 goto comm_command_loop
|
|
|
311 else -> goto comm_command_loop
|
